Detection rules › Sigma

Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location

Status
experimental
Severity
high
Log source
product windows, category image_load
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.

MITRE ATT&CK coverage

TacticTechniques
Defense ImpairmentT1685 Disable or Modify Tools
Credential AccessT1003 OS Credential Dumping

Event coverage

ProviderEventTitle
SysmonEvent ID 7Image loaded

Rule body yaml

title: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
id: 416bc4a2-7217-4519-8dc7-c3271817f1d5
related:
    - id: 9f5c1d59-33be-4e60-bcab-85d2f566effd
      type: similar
status: experimental
description: |
    Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.
    These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.
references:
    - https://blog.axelarator.net/hunting-for-edr-freeze/
    - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
    - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-27
modified: 2026-01-09
tags:
    - attack.credential-access
    - attack.defense-impairment
    - attack.t1003
    - attack.t1685
logsource:
    category: image_load
    product: windows
detection:
    selection_img:
        Image|contains:
            - ':\Perflogs\'
            - ':\Temp\'
            - ':\Users\Public\'
            - '\$Recycle.Bin\'
            - '\Contacts\'
            # - '\Desktop\'
            - '\Documents\'
            # - '\Downloads\'
            - '\Favorites\'
            - '\Favourites\'
            - '\inetpub\wwwroot\'
            - '\Music\'
            - '\Pictures\'
            - '\Start Menu\Programs\Startup\'
            - '\Users\Default\'
            - '\Videos\'
            #  - '\AppData\Local\Temp\' some installers may load from here
    selection_dll:
        ImageLoaded|endswith:
            - '\dbgcore.dll'
            - '\dbghelp.dll'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/info.yml

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    Image|contains:
        - ':\Perflogs\'
        - ':\Temp\'
        - ':\Users\Public\'
        - '\$Recycle.Bin\'
        - '\Contacts\'
        - '\Documents\'
        - '\Favorites\'
        - '\Favourites\'
        - '\inetpub\wwwroot\'
        - '\Music\'
        - '\Pictures\'
        - '\Start Menu\Programs\Startup\'
        - '\Users\Default\'
        - '\Videos\'

Stage 2: selection_dll

selection_dll:
    ImageLoaded|endswith:
        - '\dbgcore.dll'
        - '\dbghelp.dll'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imagematch
  • :\Perflogs\ corpus 10 (sigma 10)
  • :\Temp\ corpus 13 (sigma 13)
  • :\Users\Public\ corpus 15 (sigma 15)
  • \$Recycle.Bin\ corpus 2 (sigma 2)
  • \Contacts\ corpus 5 (sigma 5)
  • \Documents\ corpus 2 (sigma 2)
  • \Favorites\ corpus 6 (sigma 6)
  • \Favourites\ corpus 5 (sigma 5)
  • \Music\ corpus 4 (sigma 4)
  • \Pictures\ corpus 5 (sigma 5)
  • \Start Menu\Programs\Startup\ corpus 2 (sigma 2)
  • \Users\Default\ corpus 4 (sigma 4)
  • \Videos\ corpus 4 (sigma 4)
  • \inetpub\wwwroot\ corpus 2 (sigma 2)
ImageLoadedends_with
  • \dbgcore.dll corpus 6 (sigma 6)
  • \dbghelp.dll corpus 6 (sigma 6)